CoffeeBuddy Privacy Policy

Version: 1.1

Publication Date: 10/04/26

Effective Date: 10/04/26

1. About This Policy

CoffeeBuddy is provided by CINO Technology(Shenzhen) Limited ("we," "us," or "our"). Our registered address is 16th Floor, Block D, Building 3, Yunzhi Technology Park, South Side of Shuangming Avenue, Dongzhou Community, Guangming Subdistrict, Guangming District, Shenzhen.

This Policy explains how we process your personal information when you use the CoffeeBuddy application, related cloud services, and features that expressly refer to this Policy, and how you can manage that information and exercise your rights.

Under applicable law, we are the personal information processor or data controller for the processing described in this Policy. A third party that independently determines the purposes and means of its own processing may be a separate personal information processor or data controller.

This Policy does not replace the privacy policies of independent third-party services. Where appropriate, we distinguish processing for our Service from independent processing by third parties.

Reading this Policy, accepting the Terms of Service, granting system permissions, and consenting to particular processing activities are separate matters. This Policy does not constitute blanket authorization for all processing. We will obtain consent, separate consent, or other authorization where required by law.

2. Information We Process and Why

We process information according to the features you actually use. Information may be provided by you, generated through operation of the application or device, or provided by a third party you authorize.

2.1 Accounts and Third-Party Sign-In

CoffeeBuddy currently supports sign-in with Apple, Google, and WeChat. We process an internal account identifier, sign-in method, account status, and information actually supplied by the selected sign-in service to verify your identity, create or link an account, maintain your session, and protect account security.

The information varies by sign-in method. We receive some fields only if you authorize their disclosure and the provider supplies them:

These sign-in processes do not require you to provide your Apple, Google, or WeChat password to CoffeeBuddy. Credentials used to verify a sign-in are different from persistently stored account information; the table does not mean that every listed credential is retained long term.

We also process account settings you choose in the application, such as display name, language, and time zone, to display your account and provide the Service according to your choices. A third-party provider may not supply all information on every sign-in, and we may continue to use account information previously obtained lawfully.

If you do not provide information necessary for sign-in, you cannot use features that require an account. The independent processing activities of third-party sign-in providers are governed by their own privacy policies.

2.2 Device Linking, Wi-Fi Setup, and Connectivity

When you add, link, set up, or connect a device, we process its device identifier or serial number, brand, model, device name, hardware and firmware versions, capabilities, account-to-device links, member roles, linking time, setup progress, connection state, and online status.

We use this information to identify devices, verify permission to operate them, establish connections, display their status, and handle unlinking, device transfers, and connection problems. A device identifier may itself serve as its serial identifier; this does not mean we store two separate numbers for every device.

During Wi-Fi setup, you select a network name from those scanned by the device or enter one manually, then enter its password. The Wi-Fi name and password are sent to the coffee machine through the local setup connection. They do not pass through our cloud or get stored there. The coffee machine uses them to connect to the network.

Your phone may temporarily retain the network name and setup state to complete setup and restore the setup screen. The coffee machine stores its network configuration locally; clearing it requires a factory reset. A statement that information is not stored in our cloud does not mean it is absent from the device.

Once device information is associated with an account, it may constitute personal information. Linked users can view the device's status. The device owner can view current members' display names, profile images, roles, and linking times; other members can view the owner's display name and profile image. Preparation history is filtered by the current account: you can view your own preparations on that device and local device preparations not assigned to an individual, but not another member's preparations expressly assigned to that member through this interface. The member information API does not provide another person's conversations or personal preferences.

2.3 Device Status, Control Commands, and Preparation History

When you view or control a device, we process its online and operating status, telemetry, fault and maintenance information, beverage preparation and other control commands, recipe parameters, operation times, execution status, and preparation history.

We use this information to display the device's condition, perform actions you confirm, determine outcomes, avoid duplicate actions, troubleshoot problems, and show your preparation history. Device status and history may be associated with an account, device member, or specific operation.

Do not put unnecessary personal information in a device name or another field that other authorized users may see.

2.4 Preferences, Recipes, Bean Information, and Memory

We process your language settings, beverage preferences, recipe parameters, coffee bean information, personalization settings, and information needed for features you actually use, such as favorites, to save your choices, display information, and provide personalized coffee suggestions.

CoffeeBuddy's memory includes information you expressly ask it to remember and preferences or facts that CoffeeBuddy determines may help with future service based on information you expressly provide, such as tastes, dietary restrictions, usual drinks, and recent feedback. The system should not record a guess you have not expressed as a confirmed fact.

Memory may be used as context in later conversations to understand requests and generate suggestions. This provides personalized service; it does not mean the content is used to train a model.

You can ask by text or voice in a conversation to delete a particular memory or clear all long-term memory. On receiving a request to clear it, the system deletes saved long-term memory entries one by one. User profiles, communication style, separately stored taste preferences, and recipe adjustments are different records and are not automatically cleared merely by deleting long-term memory entries.

Clearing long-term memory does not delete conversation history, preparation history, or all account data. There is currently no switch to disable creation of future memories; new information you express may still become memory under the rules above. You may request deletion of other information or your account as described in Sections 10 and 11.

2.5 AI Conversations

When you use AI conversations, we process the text you submit, conversation context needed to understand the current request, and relevant language, device status, beverage, recipe, coffee bean, and memory information.

According to the operator, AI conversations use DeepSeek's official model service to understand requests, generate replies, provide suggestions, and assist with device actions that require your confirmation. The current production environment uses the server's default configuration: each model request contains your current input, up to the 20 most recent messages in the current conversation, and context generated from what is available at that time, such as user profile, communication style, long-term memory, coffee bean information, device identifier and status, and relevant preparation history. The limit is 20 messages, not 20 exchanges. Older conversation messages remain in our database and are not immediately deleted merely because they are excluded from a particular model request. Tool calls may provide the model with additional parameters and results needed for execution. The server uses an internal user identifier for authorization and tool calls; no separate field carrying that identifier was found in standard model messages.

Do not submit identity documents, payment details, passwords, or another person's private information unrelated to the coffee service. AI-generated text, and memories or preferences derived from it, may also constitute personal information.

2.6 Voice Input

Voice input uses cloud recognition. Recording starts when you press the recording button and stops when you release it. The feature does not listen continuously or use background voice wake-up.

The recording is sent through our service to OpenRouter, with Groq currently providing downstream speech recognition using the openai/whisper-large-v3-turbo model. Recognized text is used to process your request and may be saved as conversation content or sent to DeepSeek's model service. DeepSeek may also be used when transcription correction is enabled.

We do not extract voiceprints from recordings for identification or identify you by voiceprint.

We do not persistently store original recordings. The client deletes temporary recording files after submission, and the cloud temporarily uses audio data while processing the request. OpenRouter's and Groq's temporary processing and retention arrangements are described in Sections 6 and 8. The openai/ prefix in the model name does not mean recordings are sent directly to OpenAI's official API.

According to information provided by the operator, OpenRouter is currently configured to use Groq as the downstream speech recognition provider. Groq and Grok are different names. Public information about the relevant providers and their processing appears in Section 6; the locations where actual requests are processed and the account's retention settings remain to be verified.

The clients reviewed do not currently offer text-to-speech or read-aloud functions. If those functions are added, we will explain their processing and providers.

2.7 Images and Barcode Scanning

The current Android and iOS clients link coffee machines by entering a pairing code from the device, not by scanning a device QR code with the camera. Camera scanning reads coffee bean package barcodes: the client recognizes a barcode in the camera view locally and sends the recognized value to the cloud to query the coffee bean catalog. The camera image itself is not uploaded for that query. Manually entered barcodes are likewise sent as values for a catalog query.

On Android, which currently provides photo-based bean recognition, when you actively take or select an image of coffee beans or packaging and submit it for recognition, it is uploaded to our cloud. The cloud processes the image and sends the processed image to DeepSeek's official image recognition service. We do not persistently store the uploaded original image in our own cloud, although transmission and temporary processing in memory occur for recognition. The current iOS client does not yet offer photo-based bean recognition. The operator plans to use the same process as Android when that feature launches; photos will likewise not be persistently stored in our own cloud, and the permission explanation will be updated.

Not retaining an original image does not mean its recognition result is not retained. Recognized coffee bean or packaging information may be used to create bean records. Some recognition results, processing states, and diagnostic information are recorded in cloud logs and are subject to the applicable retention periods.

An image may contain people, addresses, labels, or other personal information. Crop or obscure irrelevant details before submitting it. The Android client reads the original image's EXIF orientation to correct its display, then re-encodes it as a JPEG before upload. The re-encoded image does not carry over the original file's EXIF, location, or other metadata. After receiving an image, the cloud also corrects its orientation and re-encodes it before sending the processed image to DeepSeek. An original image may be held temporarily on your phone after selection or capture, and its content is still involved in transmission to and temporary processing by our cloud. These steps cannot remove an address, face, or label visible in the picture itself. DeepSeek's retention of submitted images remains to be confirmed against the applicable service terms and contract.

2.8 Operations, Security, and Diagnostics

Our cloud database stores the full history of conversation messages. The limit of 20 recent historical messages sent to the model does not affect storage of older messages in the database. The cloud also stores a client's IP address in conversation records, as well as the most recent access IP and time, and uses IP addresses for rate limiting, security checks, and troubleshooting. Depending on the feature, server logs record technical information such as request correlation identifiers, account and device identifiers, request paths, error codes, and processing times. The code reviewed does not establish that all clients separately upload app version, operating system version, and device model to the cloud, and no unified client crash-log collection was found. The actual collection of those fields depends on the specific feature and production deployment.

Android barcode scanning uses Google ML Kit. Its SDK collects device and application information, per-installation identifiers, feature configuration and events, input and output sizes, latency, and error codes for diagnostics and usage analytics. This SDK data is transmitted using HTTPS. We currently do not integrate third-party push notification or crash analytics services. This does not mean our cloud keeps no operational or diagnostic logs, or that sign-in and device connectivity use no third-party components.

Service logs may contain device operation information, some image recognition results, and model tool-call parameters. The current server also logs AI conversation system prompts and dynamic context, which may include user profiles, long-term memory, device conditions, and recent preparation information. Complete diagnostic logs may therefore contain personal information related to conversations. According to the operator, diagnostic logs are retained for 30 days, complete diagnostic information is available to only one authorized core developer, and operations personnel can view only redacted data. Successful speech recognition logs record fields such as audio duration, file size, and transcript length; the reviewed success log did not directly contain the full transcript.

2.9 Customer Support, After-Sales Service, and Rights Requests

When you submit a support ticket, contact after-sales service, make a complaint, or exercise a personal information right, we process the contact information, description of the issue, relevant records, and identity verification information you provide as necessary to verify and resolve your request.

According to the operator, proactive human review of conversations, recordings, images, and other original content is limited to support ticket and after-sales needs, and authorized personnel see only the parts relevant to the issue. After-sales staff use a dedicated system and account permissions to view redacted data, subject to approval, oversight, and access records. Operational logs may contain the memory, context, and recognition results described in Section 2. Only one core developer can see complete diagnostic information; operations personnel can see only redacted data. We do not retain images or recordings that would otherwise not be retained merely for after-sales service. Providers' own human-access policies require separate verification.

We request verification information proportionate to the risk of the request. We do not require a complete identity document by default when less information would suffice.

3. Legal Bases for Processing

We identify a legal basis for each processing activity under applicable law. We do not rely on "your agreement to this Policy" as a single basis for all processing.

Depending on the activity, a basis may be necessity for performing a contract to which you are a party, your valid consent, compliance with a legal obligation, or a specific legitimate interest that has been assessed and balanced where applicable law recognizes that basis.

"Legitimate interests" do not replace the specific requirements for a legal basis under Chinese law. Personalization, memory, and analysis activities are not all necessarily required to perform a contract.

If we propose to use information for a purpose different from the original one, we will provide notice before processing as required by law and obtain consent again where necessary.

4. Permissions and Local Storage

We request necessary permissions in the context of the relevant feature. We do not make all permissions a universal condition of using the Service.

The current iOS client declares and uses Bluetooth, camera, and microphone permissions for relevant functions. Existing photo-based bean recognition was verified only on Android. iOS uses its camera to read coffee bean package barcodes, not to scan a device-linking code. When photo-based bean recognition launches on iOS, photos will be submitted through the Android-style process; the permissions actually used to select or take photos will then need to be checked and described.

You can manage permissions through your operating system's settings. Revoking a permission usually stops future access through that permission but does not automatically delete information previously processed lawfully.

The application stores, as needed for its functions, sign-in state, language and voice settings, legal document acceptance state, conversation screen state, and temporary files used for recording, photography, and bean recognition on your device. Android stores sign-in credentials in encrypted application preferences; iOS stores session credentials in the system Keychain. Wi-Fi setup may temporarily retain a network name and screen state. Operating system backup or device migration features may back up some local application settings and files. This is separate from our cloud database backups performed every 24 hours. The Android application currently allows system backup and has no dedicated backup-exclusion rules; the actual local backup scope on both iOS and Android also depends on the operating system, device, and user settings.

The Android application uses the ML Kit diagnostics and usage analytics described in Sections 2.8 and 6.1. We do not use advertising tracking. The current public legal document pages do not set cookies or include analytics scripts in the reviewed code. If additional non-essential technology is added later, we will update the notice before its use and obtain consent where required by law.

5. AI Data Use, Sensitive Information, and Automated Processing

5.1 Model Training and Human Access

We do not use your conversations, recordings, images, or AI output for model training, fine-tuning, or evaluation. Generating a response from the current request and necessary context is not such model training or fine-tuning.

Our proactive human review of original content is limited to the support ticket and after-sales situations described in Section 2. Complete diagnostic logs are available to only one core developer; operations personnel can view only redacted data. Whether providers retain content, conduct human review, train models, or use content for their own purposes must be checked against the actual service, account settings, and contract.

5.2 Sensitive Information

Conversations, images, or memories may contain health information, dietary restrictions, or other information treated as sensitive under applicable law. Please do not provide sensitive information that the Service does not need or another person's private information.

If a feature needs to process sensitive personal information, we will explain its necessity and effects, apply appropriate safeguards, and obtain any required separate consent, express consent, or other suitable authorization. Automatically created memories are subject to these restrictions as well.

5.3 Personalization and Automated Decisions

CoffeeBuddy may combine preferences you express, saved memories, device conditions, and relevant history to generate coffee suggestions. Suggestions may affect displayed content and recommended settings. Preparing a beverage still requires the applicable confirmation.

Based on current functions and information from the operator, we do not make decisions with legal or similarly significant effects on you solely through automated processing. AI-generated coffee suggestions and proposed device actions are for your consideration; beverage preparation still requires the applicable confirmation. You may decline a suggestion and raise questions or objections about the processing through the channels in Section 15.

6. Third Parties and Disclosure of Information

6.1 Current Providers

Google ML Kit data disclosure

Public provider materials identify the following entities and terms. The entities actually contracted with and the terms applicable to this project's requests still need to be checked:

• DeepSeek's Open Platform publicly identifies Hangzhou DeepSeek Artificial Intelligence Co., Ltd. as its operator. See its Open Platform Terms and Privacy Policy. That policy expressly says it does not replace the information-processing rules of downstream applications for their end users.
• OpenRouter publicly identifies OpenRouter, Inc. See its Privacy Policy, which explains that model requests are forwarded to actual inference providers; processing also depends on the selected provider and account settings.
• Groq publicly identifies Groq LLC. See its Privacy Policy and GroqCloud customer data documentation. Groq states that customer content in inference requests is not retained by default but may be retained temporarily for up to 30 days for troubleshooting or abuse investigations, unless law requires otherwise. Where retained, its public documentation identifies the United States as the storage location for customer data. The applicable terms and settings still need to be verified when this project calls Groq through OpenRouter.

This list covers the third-party client SDKs and server calls identified so far. A model identifier is not a provider's legal name. Providers may also process information through subcontractors.

For providers acting on our instructions, we use appropriate arrangements addressing purpose, information scope, security, retention, and deletion. We distinguish independent third-party processing and provide notices and obtain authorization as required by law.

6.2 Other Disclosures

If you actively request disclosure to another recipient, we will explain the recipient, scope, and purpose in that situation and obtain any necessary authorization.

Where there is an appropriate legal basis, we may disclose necessary information to comply with legal obligations, respond to valid legal process, handle security incidents, or protect lawful rights. We will review legality, necessity, and scope and comply with restrictions on cross-border disclosure.

If a merger, reorganization, or business transfer involves information transfer, we will provide notice as required by law, require the recipient to undertake applicable protection obligations, and obtain renewed consent where necessary.

We currently do not sell personal information, share it for advertising purposes, or publicly disclose it for advertising. The sign-in, cloud infrastructure, and AI providers listed in Section 6.1 still receive information necessary for their respective functions. Those disclosures and the third parties' own processing are distinguished under this Policy and applicable law.

7. Storage Locations and Cross-Border Processing

Our primary cloud servers, database, and storage use Tencent Cloud and are deployed in Silicon Valley, United States.

According to information provided by the operator, backup and disaster recovery locations are also in Silicon Valley. Operations personnel able to access relevant data remotely are in Shenzhen, China. After-sales staff use a dedicated system, subject to permissions, approval, oversight, and access records, to remotely view redacted data related to support tickets; their access location is Shenzhen. AI, speech, and sign-in providers may process information in other countries or regions; their locations and scope must be supplemented as described in Section 6.

Accordingly, "primary data is in Silicon Valley" does not mean all processing occurs there. Transmission, provider processing, or remote access outside your region may constitute cross-border processing subject to applicable law.

We will adopt applicable cross-border mechanisms and necessary safeguards as required by law.

Where the law requires notice about overseas recipients, separate consent, or other procedures, we will complete those steps before the relevant processing. You may contact us using the details in this Policy to learn about safeguards and, where permitted by law, obtain copies of or information about relevant documents.

8. Retention Periods

While you normally use the Service, we retain information needed to continue providing accounts, device management, conversations, and personalization. We do not persistently store original recordings. After account deletion, the current cloud account-deletion process removes the account and its associated personal business data; the limits concerning logs, backups, and third-party providers are described below and in Section 11.

When setting retention periods, we consider service purposes, information sensitivity, legal requirements, and necessary dispute handling. When a period ends, a purpose has been fulfilled, or deletion is legally required, we delete information or anonymize it in a manner that meets legal requirements. Replacing only a user identifier does not amount to anonymization.

Where a legal retention obligation or another applicable exception exists, we restrict purpose and access. Account deletion or memory clearing first removes the relevant information from the live business database; backups made before deletion rotate out on the 7-day cycle above and are used only for disaster recovery.

9. Security

We take technical and organizational measures appropriate to the nature of the information and the risks to restrict unauthorized access, disclosure, alteration, and loss. Personnel may access only the information needed for their roles and authorizations.

Current mobile applications communicate with the cloud over the public internet using HTTPS. App APIs requiring sign-in verify identity through time-limited JWTs and server-side session status; access to device information and operations also depends on valid account links and roles. Android stores sign-in credentials in encrypted application preferences; iOS uses the system Keychain. The server rate-limits some requests and records audit information for actions such as changes to device membership. Complete diagnostic logs are accessible to only one authorized core developer; operations and after-sales personnel view redacted data through systems subject to permissions, approval, oversight, and access records.

No system can guarantee absolute security. If a security incident occurs, we will take remedial measures as required by law and, where applicable, notify the competent authorities and affected individuals of the effects and recommended responses.

10. Your Rights and Choices

Depending on applicable law and the circumstances, you may have rights to be informed; access and obtain a copy; correct or delete information; withdraw consent; restrict or object to processing; receive portable data; refuse direct marketing; and opt out of applicable sales, sharing, or targeted advertising.

For applicable automated decisions, you may request an explanation, human intervention, or an opportunity to object as provided by law. You may also complain to a competent regulator or seek legal remedies.

Request channels:

• Account deletion: "Me" → "Privacy & Legal" → "Delete Account" in the application.
• Privacy email: support@citaly.com.
• Telephone: +86075529850626.

We verify identity in a manner proportionate to the risk and support authorized agent requests where required by law. We respond within applicable legal periods and explain any lawful extension and its timing.

Ordinary rights requests are generally free of charge. If the law permits a fee or refusal for a manifestly unfounded or excessive request, we will explain the reason and available remedies. We will also explain any limits caused by legal obligations, the rights of others, or applicable exceptions.

You will not be subjected to improper discrimination for exercising your rights. Refusing information necessary for a feature may, however, prevent us from providing that feature. Withdrawal of consent does not affect the lawfulness of processing based on valid consent before withdrawal.

11. Account Deletion and Data Removal

On Android or iOS, go to "Me" → "Privacy & Legal" → "Delete Account," read the notice, and confirm deletion. We verify your account through the current sign-in session. If you own a shared coffee machine, you must first transfer ownership. If a brew associated with the account is in progress, wait until it finishes and try again.

Signing out, uninstalling the application, unlinking a device, and clearing memory are different from deleting your account and do not automatically delete all cloud history. After successful account deletion, we delete the account, sign-in identities and sessions, conversations and memories, personal adjustments, preparations belonging to that account, and device links. Other members' information on a shared device and the device's own records are not deleted with your account. Diagnostic logs are retained for 30 days; database backups created before deletion are cleared on a 7-day cycle. To revoke Apple sign-in credentials, the system attempts revocation with Apple at deletion. If revocation is not completed, an encrypted credential may be retained temporarily during a 24-hour retry period and cleared by a later task.

Account deletion does not necessarily remove information stored separately on a coffee machine or phone. Before transferring a device, unlink it and clear its local configuration according to its instructions.

We handle deletion instructions to providers acting on our behalf under the applicable arrangements. You may need to contact an independent processor separately about information that it holds.

12. Children and Minors

The Service currently has no uniform minimum age for use, no feature specifically directed at children, and no age-verification process. Minors should use the Service under the guidance of a guardian.

Where guardian consent is required by law, we must obtain it before processing the relevant personal information. Special protections apply to personal information of children under 14 in China, including parental or other guardian consent and dedicated processing rules.

If a guardian believes a child submitted information without meeting these requirements, they may contact us. After reasonable verification, we will restrict processing or delete the information as required by law.

13. Region-Specific Information

This section applies only where the relevant law governs a particular processing activity. Omitting a region does not affect rights granted by applicable local law. The choice of law in the Terms of Service likewise does not exclude applicable personal information protection rules.

13.1 Individuals in China

We handle sensitive personal information, disclosures to other independent processors, public disclosures, and transfers abroad in accordance with law, including applicable notice, consent, and other requirements. You may ask us to explain our processing rules and exercise rights of access, copying, correction, and deletion as provided by law.

13.2 Individuals in the European Economic Area and United Kingdom

Subject to applicable conditions, you may exercise rights of access, rectification, erasure, restriction, portability, and objection. You may withdraw consent where processing is based on consent, object on grounds relating to your circumstances where it is based on legitimate interests, and object to direct marketing.

You may complain to a competent supervisory authority in your usual place of residence, place of work, or place of an alleged infringement. Individuals in the United Kingdom may also complain to the UK Information Commissioner's Office.

European Economic Area representative: None currently appointed. United Kingdom representative: None currently appointed. Data protection officer: None currently appointed.

13.3 Individuals Covered by Applicable US State Privacy Laws

Where applicable, you may have rights to know, access, correct, delete, and receive portable information, and to opt out of sales, targeted advertising, or certain profiling. California residents may also have rights to opt out of "selling or sharing," limit certain uses of sensitive information, and be free from improper discrimination.

14. Changes to This Policy

We may update this Policy when features, providers, processing practices, or legal requirements change and will state the version and effective date. We will prominently notify you of significant changes in the application or by another appropriate method.

Where new consent, separate consent, or other authorization is required, we will obtain it before the relevant processing begins. Merely publishing the Policy or your continued use does not replace necessary authorization. An update does not retroactively broaden the uses of information collected earlier.

15. Contact Us

Operating Entity: CINO Technology(Shenzhen) Limited

Registered Address: 16th Floor, Block D, Building 3, Yunzhi Technology Park, South Side of Shuangming Avenue, Dongzhou Community, Guangming Subdistrict, Guangming District, Shenzhen, China.

Privacy Email: support@citaly.com

Telephone: +86075529850626

We will review and address issues as required by law. Contacting us or making a complaint to us does not affect your right to complain to a regulator or seek judicial remedies.